vulnbeacon_TOOLS
← All tools

Web & TLS

security.txt validator

Read the well-known security.txt path on the exact approved host. Review required fields and contact information for responsible disclosure.

How to use security.txt validatorSteps, privacy & next steps

Check the disclosure contact and expiration at the well-known HTTPS path.

Run this check

  1. Enter the public HTTPS website you have permission to check.
  2. Confirm current permission and provide an operating contact.
  3. Review contact URI, expiration and retrieval metadata; confirm the reporting route is monitored.

What you need

  • The approved HTTPS website origin. The tool checks /.well-known/security.txt on that host.

Your input & privacy

A bounded server-side request retrieves the disclosure file. No email or telephone contact is initiated.

Read the result

Repair missing or expired fields and schedule a review before the next expiry. Verify the intended contact route with its owner.

Keep in mind

  • Redirects, root-path fallback, OpenPGP signatures and contact ownership are not verified.
  • A disclosure file is not permission to scan the site.

Your inputs, explained.

JWTs, source snippets, passwords, CSP text, files, hashes and Base64 are processed in browser memory. This toolkit does not upload or save those inputs.

Website checks send the approved URL to this service and contact the target. DNS checks disclose the domain to Cloudflare DNS over HTTPS. Email-breach checks send the full address to Have I Been Pwned when configured and explicitly requested.

Server checks are transient and rate limited. This application does not write tool input or result logs; your hosting provider and contacted services may retain network metadata under their own policies. Exports are saved only when you choose to download them.

Use tools only for assets you own or have permission to assess. Private scans and their saved reports use the separate authenticated VulnBeacon application.